CVE-2013-0262 Information

Description

rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable probably a directory traversal vulnerability that is remotely exploitable aka \symlink path traversals.\

Reference

http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html http://rack.github.com/ http://secunia.com/advisories/52033 https://bugzilla.redhat.com/show_bug.cgi?id=909071 https://bugzilla.redhat.com/show_bug.cgi?id=909072 https://gist.github.com/rentzsch/4736940 https://github.com/rack/rack/blob/master/lib/rack/file.rbL56 https://github.com/rack/rack/commit/6f237e4c9fab649d3750482514f0fde76c56ab30 https://groups.google.com/forum/!msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ https://groups.google.com/forum/!msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ